baf005e4684acb73e4ffa29c5a4803541afc2c8fdb4e4511210c3dfa43847bdf

Analysis

max time kernel
142s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:19

Target

baf005e4684acb73e4ffa29c5a4803541afc2c8fdb4e4511210c3dfa43847bdf.dll
Size

71KB
MD5

7c1a18dc7635c593462f4838319b669e
SHA1

fff7d72aea62bd85b6c339cb7114604345cff123
SHA256

baf005e4684acb73e4ffa29c5a4803541afc2c8fdb4e4511210c3dfa43847bdf
SHA512

685ef6e3310c6a0bf058efa5aeb8d190e1fd3cd7af05fa0fb4b7520789ce1b76c86bae30a76acce86bbd307e9008c3692b06795506a71605fff971ae8fab4542
SSDEEP

1536:agF0eiyUcbRO/WK5nCsQMWhsIwww0O+4qQLrGN/T8381s7nyW7:t2yFU/WK5no3g0hzQfo7838W7nyW7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4424	2696	rundll32.exe	80
PID 2696 wrote to memory of 4424	2696	rundll32.exe	80
PID 2696 wrote to memory of 4424	2696	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baf005e4684acb73e4ffa29c5a4803541afc2c8fdb4e4511210c3dfa43847bdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\baf005e4684acb73e4ffa29c5a4803541afc2c8fdb4e4511210c3dfa43847bdf.dll,#1
  2⤵
  PID:4424